Service Communication
API Gateway and Edge Policy Design Clinic
Clarify authentication flows, rate limits, and header policies at the edge without turning gateways into accidental domain logic hosts.
2 days, virtual · Clinic · starts
₩2,100,000 · informational reference only
Program narrative
Small teams work through policy layering, JWT validation boundaries, and WAF interaction. Case studies emphasize B2B SaaS with multiple tenant models.
What is included
- Policy layering canvas
- Threat modeling for public endpoints
- Rate limit budgeting tied to customer tiers
- Header normalization standards
- Gateway versus service responsibility charter
- Latency budget worksheet
- Partner onboarding checklist
Outcomes
- Publish a gateway responsibility charter signed by security and platform
- Define default timeout and payload limits per route class
- Identify three policies to migrate out of the gateway into services
Mina Cho
Customer success manager with enterprise integration background.
Participant questions
Patterns apply to Kong, Envoy, cloud-managed gateways, or in-house proxies.
Recent participant notes
API Gateway Clinic surfaced three policies that should never have lived at the edge. The charter template saved weeks of arguing.
Would have liked another half day on mutual TLS, still worthwhile.